PDF Viewer Spawning Browser or Shell for Credential-Harvest Redirect
Detects instances where common PDF reader applications (Adobe Acrobat, Foxit Reader) spawn a web browser or command interpreter process with an HTTP/HTTPS URL in the command line. This behavior is highly indicative of a user interacting with a malicious link or call-to-action embedded within a PDF document, frequently associated with credential harvesting phishing campaigns.
Sigma
